Skip to main content

Subscription and Roles

This page describes what Hyland sets up when CIN MCP is deployed for you and what your administrator configures in the CIC Administration Portal so your users can use Content Intelligence through it.

How Access Works​

Access to CIN MCP is granted to a user through the following sequence of events:

  1. A user connects their AI client to CIN MCP and signs in with their Hyland account.
  2. Hyland IAM issues a token for one environment: the environment your OAuth client is bound to.
  3. On every tool call, CIN MCP exchanges that token for one scoped to the product the tool belongs to. IAM checks that the environment is subscribed to the product and that the user has a role for it.
  4. The product applies the user's own role and permissions.
note

Each product is checked separately. A user with only a Content Lake role can use the Content Lake tools but not the Agent Builder tools.

Roles By Tool Area​

Your environment must be subscribed to the product, and the user needs a role for it in that environment.

Tool AreaProduct (App Key)Roles
Agent Builder (agent_builder_*)Agent Builder (cin-agent-builder)
  • cin-agent-builder.consumer (view and invoke agents)
  • .solution-builder (also create and edit)
  • .admin (also delete and environment settings)
Trace Observability (trace_*)Agent Builder (cin-agent-builder)An Agent Builder role
Knowledge Discovery (knowledge_discovery_*)Knowledge Discovery (hxai-discovery)
  • hxai-insight-discovery.user
  • .manager to create or change Discovery agents
Content Lake (content_lake_*) and Enterprise SearchContent Lake (content-lake, cin-ece)
  • content-lake.user (documents)
  • content-lake.ece-user or .ece-administrator (knowledge graphs and ontologies)
  • content-lake.administrator (raw graph queries)

There is no separate CIN MCP role. Every user sees the full tool list; a call to a tool fails if that tool is for a product the user has no role for.

Setup​

Step 1: Ensure Hyland Sets Up Your Subscriptions and OAuth Client​

Hyland does this when CIN MCP is deployed for you; you don't need to create anything.

  • Subscriptions. Your environment is subscribed to each product you purchased.

  • OAuth client. Hyland registers an OAuth client for your environment in Hyland IAM with the client ID cin-claude-[customerid]. This registration includes the following:

    • authorization code with PKCE and a client secret
    • the scopes the server advertises, including environment_authorization
    • the redirect URIs of the supported clients (see Authentication)
    • bound to your environment and an app key

    Hyland generates the client ID and secret and provides them, along with the app key, to your administrator through a secure channel.

  • One client per environment. A client serves only the environment it is bound to; there's no environment picker at sign-in. If you have several environments, ask Hyland for a client for each one.

Step 2: Set Up Users, Groups, and Roles​

Set up the following in the CIC Administration Portal (see the CIC Administration Portal documentation for more information):

  1. Users. Each person needs a Hyland user in the account that owns the environment. Add users in the portal, provision them through SCIM 2.0, or federate them from your identity provider (SAML).
  2. Groups. Use a group for the people who will use CIN MCP (for example "Content Intelligence AI users"), or map one from your identity provider through SCIM.
  3. Roles. Assign the product roles from the table above to the group for the environment your client is bound to. Assign only what the users need.
  4. The client's app key (required to sign in). Every user needs at least one role for the app key your OAuth client is bound to, or sign-in is refused with "The current user has not been assigned any roles for the app … in the environment …".

Role changes take effect within minutes; users don't need to sign in again.

Step 3: Connect the AI Client​

See Tutorials for details on connecting your preferred AI client.

Checklist​

  • Your environment is subscribed to each product the users need.
  • You've received the client ID, secret, and app key from Hyland, and you've stored the secret securely.
  • Each user exists in the Hyland account that owns the environment.
  • Users are in a group with the product roles they need for that environment.
  • Each user has a role for the OAuth client's app key.
  • The AI client is connected (organization connector added or local setup done).
  • One user has run a read-only tool from each product area (for example, agent_builder_list_agents, content_lake_list_folders and knowledge_discovery_list_agents).